Divi Membership vulnerabilities

2 known vulnerabilities in Divi Membership from DiviEngine. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Divi Membership: Improper Privilege Management

  CVE-2026-19652Oct 2, 2026DiviEngine

  The Divi Membership plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.0. This is due to the `dmem_form_submit_handler()` function determining the new user's role by iterating all WordPress roles and calling `passw

• 9.8 Critical severity

  Divi Membership: Improper Authentication

  CVE-2026-19660Oct 2, 2026DiviEngine

  The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.0. The `process_paypal_callback` function, hooked to the `init` action, accepts a base64-encoded `paypal_param` GET parameter with no IPN